Privacy Policy

Controller vs. processor: important distinction

Atomically acts in two distinct roles depending on the data:

• As controller: for personal information about you (the individual interacting with the Site, signing up for an account, paying for a subscription, communicating with us).
• As processor on behalf of a customer: for personal information processed through the Service in connection with a customer's business use. Examples: (a) personal information about the people a customer invites to use the Service; (b) personal information contained in content a customer submits. In these cases, the customer is the controller and the customer's privacy notice and lawful basis govern.

If you were invited to the Service by an Atomically customer, or your personal information is in content a customer submitted to the Service, address access / deletion / correction requests to that customer; we will support that response.

1. Information We Collect

(a) Account and contact information: your email address, password, and the account details you give us.

(b) Billing information: your plan and subscription. Full payment-instrument data is collected and stored by our payment processor and never touches our servers.

(c) Authentication and security data: IP address, sign-in records, and security logs.

(d) Usage data: how you use the Site and the Service, such as the pages you visit, the features you use and the actions you take in it, and the browser, operating system, device type and preferred language your browser reports. We also measure how pages of the Site and the Service are used and how quickly they load, with a first-party script that we serve from our own servers: how long a page is in view, how far it is scrolled, which of our calls to action and which links to other websites (including links between the Site and the Service) are clicked (recorded by a fixed name for the button, or by the other website's domain name, with the part of the page it was in, such as the header or the footer, and never by the words on the page or anything you type), which parts of a page come into view and which of our questions are opened (each recorded by a fixed name we give it), the steps of our forms (whether one was started, sent, or refused by one of our checks, recorded by the name of that check, such as that an email address was incomplete, and never anything you type into it), the errors a page runs into (counted by their general kind, such as a script error or an image that did not load, and never their message or details), the size category of your screen, how the page was reached (such as by a link, a reload or the back button), and standard page-speed measurements. The script uses no cookies, stores no identifier on your device, and sends its measurements only to our own servers. When your browser tells our pages that you have turned on Do Not Track or Global Privacy Control, the script measures and sends nothing, and our servers discard any measurement that arrives with either signal. We record these measurements under the same pseudonymous identifier as the pages you visit that day, with the browser, operating system, device type, preferred language and approximate location we record for those pages. Our servers compute that identifier from your IP address and your browser's user agent with a secret value that we replace every day, so the identifier contains neither and your browser has a different identifier each day. We discard each day's secret value after that day ends, and that day's identifier can then no longer be computed. For analytics, we derive your approximate location (country, region and city) from your IP address on our own servers and keep only that location, not the address.

IP geolocation by DB-IP, used under its Creative Commons Attribution license.

When a page you ask for cannot be found, our servers also record the address that was asked for, with any part that is not an ordinary page name (such as anything that could hold an email address, a number or a code) replaced, and where the link to it was: the other website's domain name alone, or the page of ours that held it. When you join the list of people to be told when the Service opens, or create an account from an invitation, we also record, under a pseudonymous identifier of your entry or account, the page of the Site you first visited that day and the website or campaign that brought you to it.

(e) Activity in the Service: when you are signed in, the actions you take in the Service, such as signing in, inviting people, creating and publishing reviews, opening the reviews shared with you, commenting, voting and approving, recorded under a pseudonymous identifier linked to your account. We record the day each action happened, not the time, and we keep these records apart from our records of the pages you visit, so the two are never combined. These records never include anything you write, and the link to your account is removed within 12 months, or sooner if you ask.

(f) Customer-submitted content: the content you submit to or create through the Service, including the contact details of people you invite.

(g) Communications: emails, support tickets, and feedback you send to us.

(h) Cookies and similar technologies: see Section 7.

We do not knowingly collect special categories of personal data under GDPR (e.g., health, biometric, genetic, racial, religious, political, sexual-orientation data) or HIPAA-regulated health information. Do not submit such data to the Service.

2. How We Use Information

We use personal information to:

• provide, operate, secure, and improve the Service;
• authenticate users, prevent fraud and abuse, and enforce our terms;
• process payments and manage subscriptions, including renewals;
• send transactional emails (account, security, and billing notices) and, where you have opted in, marketing emails (product announcements);
• generate analytics to operate and improve the Site and the Service, from pseudonymous records that do not include your name, email address or IP address, never to train, fine-tune, evaluate, or improve any AI model;
• comply with legal obligations and respond to lawful requests; and
• communicate with you about your account, the Service, and our products.

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising.

3. Legal Bases (GDPR / UK GDPR)

For individuals in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing are:

• Contract: processing necessary to perform our agreement with you or to take steps at your request before entering into an agreement (account creation, billing, providing the Service).
• Legitimate interests: securing the Service, preventing fraud, improving the product, and conducting analytics, where our interests are not overridden by your fundamental rights.
• Legal obligation: complying with applicable law (e.g., tax, anti-money-laundering, lawful requests).
• Consent: for marketing emails and any other processing where consent is required. You may withdraw consent at any time without affecting prior processing.

4. How We Share Information; Sub-processors

We share personal information with the categories of recipients below.

(a) Service providers (sub-processors) that perform services on our behalf, under contracts that restrict their use of personal information. Major categories:

• cloud hosting and storage;
• payment processing; and
• AI inference (no training on customer data via these providers).

We do not authorize our AI service providers to train on customer data submitted to them. We do not train any model on your content (see Section 6).

(b) Professional advisors: attorneys, accountants, auditors, and bankers, under confidentiality obligations.

(c) Legal and safety: to comply with applicable law, respond to lawful requests (subpoena, court order), protect our rights and the rights of others, and prevent fraud or harm. Where permitted, we will notify you of legal requests for your data.

(d) Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the acquiring or successor party will be bound by this Privacy Policy or a successor policy with materially comparable protections.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your personal information (subject to legal retention obligations);
• Restrict or object to certain processing;
• Receive a portable copy of your personal information;
• Withdraw consent at any time where processing is based on consent;
• Opt out of "sale" / "share" / targeted advertising under U.S. state privacy laws (we do not sell or share for behavioral advertising, but you may exercise this right at any time);
• Lodge a complaint with a supervisory authority.

Response timelines. We will verify your identity and respond to access, correction, deletion, restriction, and portability requests within the time required by applicable law. We will not discriminate against you for exercising your rights.

Authorized agents. Authorized agents may submit requests on your behalf with appropriate authorization. We may verify the agent's authority before responding.

Requests from people a customer invited. If you were invited to the Service by one of our customers, or your personal information is in content a customer submitted to the Service, please address requests to that customer first. We will support the customer in responding to your request.

To exercise any right, email operations@atomically.ai.

6. AI and Model Training

We do not train on any user data for Nucleus. We do not use your content, or anything derived from it, to train, fine-tune, evaluate, or improve any model, ours or anyone else's, and our AI service providers are not permitted to train on it.

We keep the materials you submit, the selections and approvals you make, and your brand assets with your account, and use them to tailor future designs for you. They are used only for your account, are never used to train a model or shared with another customer, and you can ask us to delete them at any time.

7. Cookies and Similar Technologies

Strictly necessary

Authentication, session, security, CSRF protection. Required: yes (cannot be disabled).

The Service uses only strictly necessary cookies, for sign-in and security.

We do not use advertising or cross-site tracking cookies, and we do not track you across third-party websites. We measure how our pages are used with a first-party script that uses no cookies (see Section 1); when your browser tells our pages that you have turned on Do Not Track or Global Privacy Control, that script measures and sends nothing, and our servers discard any of that script's measurements that arrives with either signal. We keep the records our servers make of the pages you visit (see Section 1) whether or not your browser sends either signal. When a page you ask for cannot be found and your browser sends either signal, our servers do not record which address was asked for. You can manage cookie preferences through your browser settings; disabling strictly-necessary cookies will impair the Service.

8. Data Retention

We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Typical retention:

• Account data: for the life of the account, and after it closes for as long as tax, accounting, and other legal requirements need.
• Billing records: for as long as tax and accounting law requires.
• Support communications: for as long as needed to respond to you and to keep a record of the request.
• Server logs (requests and security-relevant events): for a limited period, then deleted.
• Analytics records: kept, with any link to your account removed within 12 months, or deleted sooner if you ask. Before our analytics server has a record, our own servers may hold it for a short time, and delete it once it is sent or is too old to send.

9. Security

We implement reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit and at rest. No system is perfectly secure; we cannot guarantee absolute security.

If we confirm a security incident affecting your personal information, we will notify you and applicable authorities as required by applicable law.

Security-issue reports may be sent to operations@atomically.ai.

10. International Transfers

Atomically is based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States. For transfers from the EEA, UK, or Switzerland, where required by law, we will rely on an appropriate transfer mechanism.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact operations@atomically.ai and we will delete it.

12. Email Practices; CAN-SPAM and CASL Compliance

We send two categories of email:

• Transactional (e.g., account, security, and billing notices): sent regardless of marketing preference, because they relate to your account or the Service.
• Marketing / digest (e.g., product announcements): sent only to opted-in users; each contains a clear unsubscribe link, and we honor unsubscribe requests within the time the law requires. We comply with CAN-SPAM, Canada's CASL, and the marketing-consent requirements of GDPR.

You may manage email preferences by emailing operations@atomically.ai.

13. Shared Links

The Service allows you to share content through links and invitations. Anyone who holds a shared link or invitation may be able to use it. Treat shared links and invitations as confidential.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy at https://www.designreview.app/privacy with a revised Effective Date and, for material changes, provide notice through the Service or by email. Continued use of the Service after an update constitutes acceptance.

15. State-Specific Disclosures (U.S.)

California (CCPA / CPRA). California residents have the rights described in Section 5. In the past 12 months we have collected the categories of personal information described in Section 1 for the purposes described in Section 2. We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. We do retain certain categories of personal information for longer than 12 months as described in Section 8. To exercise rights, email operations@atomically.ai.

Colorado, Connecticut, Utah, Virginia, and similar state laws. Residents have rights of access, correction, deletion, portability, and to opt out of targeted advertising, "sale," and certain profiling that produces legal or similarly significant effects. Exercise rights at operations@atomically.ai. We conduct data protection assessments where required by applicable state law.

Nevada. Nevada residents may opt out of any sale of covered information; we do not sell.

16. Contact

Contact

operations@atomically.ai